Privacy Policy

Effective Date: This Privacy Policy applies from the date you first access or subscribe to Brixoza, and describes how we collect, use, store, and protect information in connection with your use of the Platform.

1. Introduction

This Privacy Policy explains how Brixoza ("we," "us," or "our") collects, uses, stores, shares, and protects information when you access or use our web-based business management platform (the "Platform" or the "Service"), including the customer relationship management, project management, HR administration, and financial record-keeping tools available through your online dashboard.

This Privacy Policy applies to you as a customer of Brixoza, to individuals you authorise to access your Account ("Authorised Users"), and, where relevant, to the individuals whose personal data you enter into the Platform as part of your own business records, such as your customers, leads, and employees.

This Privacy Policy should be read alongside our Terms and Conditions and our Refund Policy, which together govern your relationship with Brixoza. If you do not agree with this Privacy Policy, you should not access or use the Platform.

We are committed to handling personal data responsibly and in accordance with applicable data protection law, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

2. Who We Are

Brixoza provides web-based business management software designed for small businesses, freelancers, consultants, agencies, and other service-based businesses. In the context of this Privacy Policy, we act in two distinct roles, and it's important to understand the difference between them:

As a Data Controller. In relation to the personal data we collect about you directly, such as your own account registration details, billing information, and information about how you use the Platform, we act as the data controller, meaning we determine the purposes and means of processing that personal data.

As a Data Processor. In relation to the personal data you input into the Platform about your own customers, leads, and employees, such as customer records, contact details, or employee HR information, we act as a data processor, processing that data solely on your instructions and for the purpose of providing the Platform to you. In this context, you, as our customer, act as the data controller, and remain responsible for determining what personal data to collect, the lawful basis for collecting it, and how it is used, in accordance with applicable data protection law.

This distinction matters throughout this Privacy Policy, and we address each role separately in the sections that follow.

3. Information We Collect

3.1 Information You Provide When Registering and Subscribing

When you create an Account and subscribe to a Package, we collect information such as:

your name and the name of your business;
your email address and, where provided, your phone number;
your business address and other contact details;
billing information necessary to process your Subscription payment, noting that full card details are collected and processed directly by Stripe, as explained further in Section 6;
your chosen Package and any preferences you set for your Account.

3.2 Business Data You Input Into the Platform

As you use the Platform, you and your Authorised Users will input a range of information relevant to running your business, which we refer to collectively as "Business Data." This includes:

Customer and lead information, such as customer names, contact details, sales pipeline stages, follow-up notes, and customer history;
Project information, such as project names, tasks, deadlines, and team assignments;
HR information, such as employee records, leave balances, onboarding details, and employee documents;
Financial information, such as invoices, income and expense records, payment status, and business reports generated from this data.

Business Data may include personal data relating to your own customers, leads, and employees. As explained in Section 2, we process this data as a processor acting on your instructions, and you remain the data controller responsible for this information.

We do not determine what specific categories of Business Data you choose to enter into the Platform; this is a decision you make as the operator of your own business. We would encourage you to enter only the personal data you genuinely need to run your business effectively, and to be mindful, particularly in relation to employee records, of any special category data (such as health information relating to sickness absence) that may require additional care and a specific legal basis under applicable data protection law before it is collected or stored.

3.3 Information Collected Automatically

When you access and use the Platform, we automatically collect certain technical and usage information, including:

your IP address and general location information derived from it;
device and browser information, such as browser type, operating system, and device identifiers;
log data, such as pages or features accessed, timestamps, and actions taken within the Platform;
diagnostic information relating to errors, crashes, or performance issues encountered while using the Platform, which helps us identify and resolve technical problems;
cookies and similar technologies, as described in Section 9.

3.4 Information from Third Parties

We may receive limited information from third parties in connection with your use of the Platform, most notably from Stripe in relation to the processing of your Subscription payments, such as confirmation that a payment has succeeded or failed, without receiving your full card details directly.

4. How We Use Your Information

4.1 Information We Control (Your Account and Usage Data)

Where we act as data controller, we use personal data we collect about you for purposes including:

creating and administering your Account and Subscription;
processing your Subscription payments and managing billing and, where applicable, refunds under our 14-day money-back guarantee;
providing customer support and responding to your enquiries;
sending you administrative communications relating to your Account, such as billing notifications, service updates, or changes to our Terms and Conditions or this Privacy Policy;
monitoring, maintaining, and improving the performance, security, and functionality of the Platform;
detecting, investigating, and preventing fraudulent, unauthorised, or unlawful activity;
complying with our legal and regulatory obligations, including obligations relating to accounting, tax, and consumer protection law that apply to us as a business;
with your consent where required, sending you marketing communications about Brixoza, which you may opt out of at any time as described in Section 10.

4.2 Business Data You Control

Where we act as data processor in relation to Business Data you input into the Platform, we process that data solely: (a) to provide the Platform's functionality to you, such as displaying your customer records, organising your projects, storing your HR records, and generating your invoices and reports; (b) to maintain backups and ensure the security and availability of your data; and (c) as otherwise instructed by you, or as required by applicable law. We do not use your Business Data for our own independent purposes, such as marketing to your customers or employees, or combining it with other customers' data for purposes unrelated to providing the Platform to you.

4.3 Automated Decision-Making

We do not use your personal data, or the Business Data you enter into the Platform, to make decisions about you or about your customers or employees that produce legal or similarly significant effects, based solely on automated processing without human involvement. Reports and summaries generated by the Platform are intended as organisational tools to help you review your own business information; they do not constitute automated decisions made by us about you or the individuals whose data you manage.

5. Legal Basis for Processing (UK GDPR)

Where UK data protection law applies, we rely on the following legal bases to process personal data for which we act as controller:

Performance of a Contract. We process your Account and billing information because it is necessary to perform our contract with you, namely providing you with access to the Platform in accordance with our Terms and Conditions.

Legitimate Interests. We process certain usage and technical data on the basis of our legitimate interests in maintaining, securing, and improving the Platform, provided these interests are not overridden by your own rights and interests.

Legal Obligation. We process certain information, such as billing records, where necessary to comply with our legal obligations, including tax and accounting obligations.

Consent. Where required, such as for certain marketing communications or non-essential cookies, we rely on your consent, which you may withdraw at any time.

Where we act as a data processor in relation to Business Data, the lawful basis for processing that personal data is determined by you, as the data controller, in accordance with your own obligations under applicable data protection law.

6. How We Share Information

We do not sell your personal data or your Business Data. We share information only in the following circumstances:

Payment Processing. We share billing information necessary to process your Subscription payments with Stripe, our third-party payment processor. Stripe processes this information in accordance with its own privacy policy and applicable data protection law, and full card or bank account details are handled directly by Stripe rather than being stored on our own systems.

Service Providers. We may share information with third-party service providers who perform functions on our behalf, such as cloud hosting, infrastructure, data storage, customer support tools, and analytics, strictly for the purposes of operating and improving the Platform, and subject to appropriate contractual safeguards.

Legal and Regulatory Requirements. We may disclose information where required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud or security issues.

Business Transfers. If Brixoza is involved in a merger, acquisition, reorganisation, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality and data protection safeguards, and we will notify you of any such change in ownership or control where required.

With Your Direction. Where you use integrations or features within the Platform that involve sharing information with a third party at your instruction, information will be shared accordingly, subject to that third party's own privacy practices.

We do not share your Business Data with other customers of Brixoza, and we do not share your customers' or employees' personal data with third parties for our own independent marketing or commercial purposes.

7. International Data Transfers

Some of our service providers, including certain hosting and infrastructure providers, may process data outside of the United Kingdom. Where personal data is transferred internationally, we take steps to ensure that appropriate safeguards are in place, such as relying on adequacy regulations, standard contractual clauses, or other legally recognised transfer mechanisms, to ensure that personal data continues to receive an appropriate level of protection consistent with UK data protection law.

8. Data Retention

Account and Billing Information. We retain information relating to your Account and Subscription for as long as your Account remains active, and for a reasonable period afterwards to comply with our legal, accounting, and tax obligations, and to resolve any disputes.

Business Data. We retain your Business Data for as long as your Subscription remains active, and, following cancellation or termination, for a limited retention period during which you may be able to request export or reactivation of your Account, as described in our Terms and Conditions. After this period, we will delete or anonymise your Business Data from our active systems, except where retention is required by law or necessary to resolve disputes or enforce our agreements.

Technical and Usage Data. We generally retain technical and usage data for a shorter period, sufficient to support the security, performance monitoring, and improvement purposes described in Section 4, after which it is deleted or aggregated in a form that no longer identifies you.

Specific retention periods may vary depending on the type of data and the purpose for which it was collected, and we periodically review our retention practices to ensure that we do not keep personal data for longer than necessary.

Why We Retain Data for These Periods. Our retention periods are set with reference to the purpose for which the relevant category of data was collected. Account and billing information is retained for a period consistent with our legal and accounting obligations, since financial records typically need to be kept for a number of years under applicable tax law. Business Data is retained for a shorter, limited period following the end of your Subscription, primarily to give you a reasonable opportunity to export your records or reactivate your Account, rather than for any independent purpose of our own. Technical and usage data is generally retained for the shortest period consistent with its purpose, since its value to us diminishes relatively quickly once it is no longer useful for security monitoring or service improvement.

Deletion and Anonymisation. Where we no longer have a valid basis to retain personal data in identifiable form, we will either delete it or anonymise it so that it can no longer be used to identify you or any individual whose data forms part of your Business Data. Anonymised or aggregated data that no longer identifies any individual is not considered personal data and may be retained and used by us without the restrictions set out in this Privacy Policy.

9. Cookies and Similar Technologies

We use cookies and similar tracking technologies on our website and within the Platform to help the Platform function properly, to remember your preferences, and to understand how the Platform is used so that we can improve it.

Essential Cookies. Some cookies are necessary for the Platform to function, such as those that keep you logged into your Account, and these cannot be switched off without affecting the operation of the Platform.

Analytics and Performance Cookies. We may use cookies or similar technologies to understand how customers use the Platform, helping us identify areas for improvement. Where required by law, we will seek your consent before using non-essential cookies of this kind, and you will generally be able to manage your cookie preferences through a cookie banner or your browser settings.

Managing Cookies. Most web browsers allow you to control cookies through their settings. Please note that disabling certain cookies may affect the functionality of the Platform.

10. Marketing Communications

From time to time, and where you have consented or where otherwise permitted by law, we may send you marketing communications about Brixoza, such as updates about new features or relevant offers. You can opt out of receiving marketing communications at any time by following the unsubscribe instructions included in those communications, or by contacting us directly using the details in Section 14.

Please note that even if you opt out of marketing communications, we will continue to send you essential administrative communications relating to your Account and Subscription, such as billing notifications and important service updates, as these are necessary for us to provide the Platform to you.

11. Data Security

We take the security of personal data seriously and implement appropriate technical and organisational measures designed to protect information stored on the Platform against unauthorised access, alteration, disclosure, or destruction. These measures include, among others, the use of encryption for data in transit, access controls limiting who can access different parts of the Platform, and processing of payment information through Stripe rather than storing full card details on our own systems.

While we take reasonable steps to protect your information, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. You also play an important role in protecting your own information, including by keeping your Account credentials confidential and managing access permissions for your Authorised Users responsibly, as set out in our Terms and Conditions.

If we become aware of a data security incident affecting your personal data or Business Data, we will take appropriate steps in accordance with applicable law, including notifying you and, where required, the relevant supervisory authority, without undue delay.

Organisational Measures. Beyond technical safeguards, we maintain internal practices designed to limit access to personal data to those who genuinely need it to perform their role in operating and supporting the Platform, and we take reasonable steps to ensure that anyone with such access understands their responsibilities in relation to confidentiality and data protection.

Your Role in Security. Security is a shared responsibility. In addition to keeping your Account credentials confidential, we would encourage you to use a strong, unique password for your Brixoza Account, to review the access permissions granted to your Authorised Users periodically, and to remove access promptly for any team member who no longer requires it, such as when an employee leaves your business.

12. Your Rights

12.1 Your Rights as a Customer (Data We Control)

Where we act as data controller in relation to your own personal data, such as your Account and billing information, you have a number of rights under UK data protection law, including the right to:

access the personal data we hold about you;
rectify inaccurate or incomplete personal data;
erase your personal data in certain circumstances;
restrict our processing of your personal data in certain circumstances;
object to processing based on our legitimate interests, including direct marketing;
data portability, allowing you to receive certain personal data in a structured, commonly used, machine-readable format;
withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details in Section 14. We will respond to your request in accordance with applicable law and within the timeframes it requires.

Verifying Your Identity. To protect your personal data from unauthorised access, we may need to verify your identity before responding to a rights request, for example by confirming details associated with your Account. This is intended to ensure that personal data is only disclosed to, or acted upon at the request of, the individual it relates to.

No Fee, Except in Limited Circumstances. We will not generally charge a fee to respond to a request to exercise your rights. However, where a request is manifestly unfounded, excessive, or repetitive, applicable law may permit us to charge a reasonable administrative fee, or to decline to act on the request, in which case we will explain our reasoning to you.

12.2 Rights of Individuals Whose Data You Manage (Business Data)

Where personal data is entered into the Platform as Business Data, such as your customers' or employees' information, you, as our customer, are the data controller responsible for that information, and any rights requests from those individuals, such as a customer or employee wishing to access or correct their own data, should generally be directed to you rather than to Brixoza. Where appropriate, we will assist you in responding to such requests in relation to data held within the Platform, in accordance with our role as your data processor and any applicable data processing terms between us.

12.3 Complaints

If you have concerns about how we have handled your personal data, we would encourage you to contact us first so that we can try to resolve the issue directly. You also have the right to lodge a complaint with the Information Commissioner's Office ("ICO"), the UK's independent authority for data protection, if you believe your data protection rights have been infringed. Further information is available at ico.org.uk.

13. Subprocessors

In order to provide the Platform, we engage certain third-party service providers who process personal data on our behalf as subprocessors, such as cloud hosting providers who store the data underlying the Platform, and Stripe, who processes Subscription payments as described in Section 6. We take reasonable steps to ensure that any subprocessor we engage is bound by data protection obligations consistent with this Privacy Policy and applicable data protection law, including, where relevant, appropriate contractual terms governing their processing of personal data on our behalf. Where we engage a new subprocessor that will have access to Business Data in a way that represents a material change, we will take reasonable steps to make this information available to you, such as through updates to this Privacy Policy or our website.

14. Contact Us

If you have any questions about this Privacy Policy, or would like to exercise any of the rights described above, please contact us at:

Email: ceciliasoren9@gmail.com or support@brixoza.co.uk

Address: 175 St. Andrews Avenue, Havering, RM12 5ED, United Kingdom

We aim to respond to privacy-related queries as promptly as we reasonably can, and in any event within the timeframes required by applicable data protection law.

15. Children's Privacy

The Platform is intended for use by businesses and individuals aged 18 or over, in accordance with the eligibility requirements set out in our Terms and Conditions. We do not knowingly collect personal data from children, and the Platform is not directed at, or designed for use by, children. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take steps to delete that information promptly.

16. Third-Party Links and Services

The Platform may, from time to time, contain links to third-party websites or services, or may integrate with third-party tools at your instruction. This Privacy Policy does not apply to those third-party websites or services, and we encourage you to review the privacy policies of any third party whose website or service you access or connect to the Platform.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform, our data practices, or applicable legal requirements. Where we make a material change, we will take reasonable steps to notify you, such as by updating the effective date at the top of this page, or by notifying you directly where appropriate. We encourage you to review this Privacy Policy periodically to stay informed about how we handle personal data. Your continued use of the Platform following any such update constitutes your acceptance of the revised Privacy Policy.

18. Acknowledgement

By creating an Account, subscribing to a Package, or otherwise accessing or using the Platform, you confirm that you have read and understood this Privacy Policy, and, where you input personal data relating to your own customers, leads, or employees as Business Data, you confirm that you have the necessary legal basis and authority to do so, and that you accept responsibility, as data controller, for that data in accordance with applicable data protection law.